Add service validation and encapsulation

This patch moves the keystone service resource
to a new class, keystone::service, and adds
a new resource that uses the admin credentials
to confirm the keystone server is accepting
connections and functioning well from the client
perspective. This validation resource is optional
and if specified will be required by all keystone
custom types.

In order to take advantage of this change, consumers
of the keystone service should depend on this class
instead of the keystone service.

Change-Id: Ibd92a7c40658bb242b3b55980489949cb5835145